Mikhail Klementev, Ronnie Goodrich and Andrew Krasichkov discovered thatmissing restrictions in the implementation of the WEBSERVICE functionin LibreOffice could result in the disclosure of arbitrary filesreadable by the user who opens a malformed document.

For the stable distribution (stretch), this problem has been fixed inversion 1:5.2.7-1+deb9u2.